/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote263 views2 answers
How to sign virtualbox kernel modules
Shell/Bash
0 vote151 views1 answer
Git push main
Shell/Bash
15 votes148 views2 answers
Brew install jenv
Shell/Bash
0 vote132 views1 answer
Git push --set-upstream origin master hangs
Shell/Bash
0 vote154 views2 answers
Htaccess deny all but
Shell/Bash
0 vote146 views4 answers
Like idm for linux
Shell/Bash
10 votes154 views4 answers
Ifconfig not found ubuntu
Shell/Bash
6 votes160 views1 answer
Bash find in all subdirectories
Shell/Bash
0 vote138 views1 answer
Go2shell settings
Shell/Bash
1 vote162 views1 answer
Install fontforge linux
Shell/Bash